Rewatching She Hulk with my wife. This is such a cute show. Really a shame it got cancelled.
Remote
Zachary Cutlip
@zcutlip@hachyderm.io
mastodon 4.7.3he/him, feminist
offensive security researcher specializing in apple things
reverse engineering, binary formats, debuggers, & hex editors are my jam
creator of pyonepassword, a #python library for interacting with 1Password: https://github.com/zcutlip/pyonepassword
creator of the #StarWars planets bot, @StarWarsPlanets@holonet.imperialba.se
393 Followers
193 Following
48 Posts
Joined December 19, 2022
The #Apple Platform Security Guide was updated yesterday (2026-08-03). Mostly a bunch of editing (oddly, changing "must" to "needs to" everywhere).
But there are four new sections:
⁃ Terminal and script protections
⁃ Search on iCloud[.]com security
⁃ SharePlay security
⁃ Nearby sharing security
The terminal and script protections is especially interesting:
⁃ Terminal paste protection
⁃ Pasteboard command blocking
⁃ Applescript scanning(!)
Here's a diff:
https://codeberg.org/zcutlip/apple-platform-security-guide/compare/2026-03.002..2026-08.000#diff-6e157a7cf35da3efec74dafd2a50c7a023bb5676
I'd been wanting to kick the tires on #Codeberg for a while, and I wanted to post the source code for my @StarWarsPlanets@holonet.imperialba.se bot, so that seemed like a good first project to publish there.
I've spent a couple of months getting the source cleaned up and presentable.
May I present to you... the Star Wars Planets Mastodon bot \o/
Replying to
@BasicAppleGuy@mastodon.social I have literally hoarded AirPort Expresses. I think I have at least five. They’re one of the most unique (but weird) and useful products Apple has ever made and there’s basically no alternative for the things they do.
RE: https://infosec.exchange/@adamshostack/116892468602075537
C+C will always be the music factory. Fight me
Getting people to try new things is incredibly hard, even when the old thing sucks and they hate it.
No one I’ve managed to convince to *try* @kagihq@mastodon.social has switched back after trying it out. Not one person. That’s insane.
The hard part is getting people to try it even once, EVEN AFTER THEY’VE SAID THEY HATE GOOGLE. Like…so many people I know *hate* what it has become, but they’d rather keep using Google than try out something new *one week*.
¯\_(ツ)_/¯
RE: https://infosec.exchange/@ryanc/116628098851548138
Spread this far and wide.
But let’s spread farther^1 and wider that a better way of disabling the Google crap is to use @kagihq@mastodon.social. Not only does the AI stay away from your search unless you ask for it, you also get better search than you’ve had in years, if ever. We’re talking Google circa ‘05-‘15 good.
Spread the news!
^1 I thought and read (and searched with Kagi) about farther vs further and have decided it’s b.s. that we have these two words and I really don’t care
My most exciting use cases and successes involving generative AI are exactly this. They aren’t about “generating text.” They involve gaining insights I *never* would have had otherwise.
Replying to
Also the ThinkGeek gags that they later turned into actual products on account of popular demand
The other #OpenCode thing is I had the coding assistant do a comparative analysis between their #privacy policy and that of #OpenRouter, both of which I use quite a lot. I asked:
For each one, summarize things that are better than expected, more worrisome than expected, and then give me a side-by-comparison of each.
They each have interesting privacy angles, with zero data retention options. They also represent a really cool way to try out a rotating set of open-weights models. And they have the pricey proprietary models from Anthropic, Google, etc., available if you need them.
RE: https://flipboard.social/@newsguyusa/116352735430273128
More than half of Americans voted for this man to be our president
Be sure to check out @kagihq@mastodon.social in a desktop browser today. I miss this kind of silliness
It’s a rare evening in #Oakland we can sit outside in whatever we’re wearing. Even on the really uncommon warm day
I had a chat with the Kagi assistant about “further” vs “farther” and I’ve decided the English language is bullshit
https://kagi.com/assistant/e598b7ed-5cab-49f2-a6a0-28a77f6bd6b2
Speaking of things related to #Git and PDFs, TIL pre-commit has a virtual "fail" language, you can use to block certain file patterns from being committed. .gitignore is important for this, but could accidentally get changed. This is a useful extra check to make sure you don't add something sensitive to version control
Boosted by @kagihq@mastodon.social
@kagihq@mastodon.social is often pitched as a better web search than Google search. I'm here to tell you they're so much more than that: Kagi is a better Google than Google full stop
In the aughts and '10s, google used to make cool, nerdy products and features just because they were cool and nerdy. They didn't need a better reason than that. They don't really do that anymore but it was good times
So here's the deal. Go to translate.kagi.com and choose "reddit speak" for the to: language. Do this in a desktop browser because you get a different UI. Thank me later
This is at least as cool and internet-nerdy as peak aughts Google ever was. Don't snooze on Kagi
#kagi
#google
#reddit
Replying to
@jamesthomson Yeah I’ve been thinking about this for a while. If companies are terrified of engineers unionizing, they’re going to love it when they’ve fired all the engineers, and now depend on one of three or four large AI companies who has them over a barrel
Edit: I should say fired and/or deskilled
Replying to
@troi@techhub.social For basic needs, @Codeberg@social.anoxinon.de has been great. They do have some downtime (not much), and for people dependent on GitHub's CI/CD, the options aren't nearly as mature. But for the core GH use cases, I really like it.
Our friends shared #Passover with us. It was really special for them to share something so meaningful.
Replying to
Other favorites include: RFC 4041 - Requirements for Morality Sections in Routing Area Drafts
“Promiscuous modes of operation are an abomination, exceeded only by multicast.”
https://www.rfc-editor.org/rfc/rfc4041
RE: https://infosec.exchange/@n_dimension/116291276920568497
Man this is the problem with Zitron. There’s usually good stuff in there—some of the best stuff I’ve read has been linked from his newsletters. But you have to sift through like 10k-15k of crazy to find it
RE: https://mastodon.social/@gwynnion/116251778411429641
Ironically, it’s not even clear this would harm republicans less than democrats. Just like Trump’s rage at mail in ballots & early voting, lots of republican voters would be disenfranchised as well
Our accountant asks clients to name all supporting tax documents according to their preferred naming convention. I'm happy to do that, but it _is_ a bit tedious
So naturally, I used generative AI to convert their Word document to a Markdown-formatted specification, then vibe-coded a tool to do the renaming. Here it is on #codeberg
RE: https://flipboard.social/@newsguyusa/116603987281751751
As deeply unpopular as Trump is, that he can unseat someone as popular as Massie in the primaries is a sign of how fucked up our primary/general election process is.
Total wackos pick the party candidates in the primaries, and normies who don’t eat and breathe party politics get stuck with those choices in the general election.
Boosted by @kagihq@mastodon.social
I've heard so much about the @kagihq@mastodon.social translator, specifically the proofreading feature, but I just got around to trying it out, and damn. This is _amazing_.
I'd sort of dismissed it because I don't often need a translation service. I assumed this was sort of a bolt-on feature that didn't merit its own home. But the proofreader should absolutely be its own first-class Kagi feature, separate from translation.
RE: https://mastodon.social/@babadookspinoza/116347907069027578
There are replicas of this hanging in the halls in the buildings on many NSA campuses
Replying to
On snap. I’d totally forgotten the Voodoo cards were add-on cards that couldn’t do 2D. They used a pass through where the voodoo sat inline between your vga card and your monitor. When a game triggered 3D mode via Glide, the Voodoo literally hijacked the wire and sent its own signal to your monitor. Presumably your 2D card was still pumping out Windows desktop or whatever, but that signal was just being discarded. That’s fucking wild.
And that doesn’t even get into SLI where two voodoo cards would take turns drawing every other scan line.
RE: https://mastodon.social/@HalvarFlake/116287831278681843
This is great advice.
Worth noting: you can also do this in a container (even on a mac -- Apple containers!).
Also worth noting: might want to ensure your SSH agent requires human approval on key accesses (SSH_ASKPASS or a password manager that provides an ssh agent)
Evidently you can now do searches on Kagi.com without being logged in. Has this always been true?
I thought in the past you still had to create an account so they could limit the number of free searches.
Presumably this is still restricted via cookies and possibly other checks.
I was curious if OpenOffice was even still a thing. Turns out…sort of but not really? There's a homebrew cask for it that's deprecated. It doesn't pass gatekeeper (probably not notarized, maybe not even signed, not sure). Also there's only an Intel build so it requires Rosetta 2, 6 years after the release of Apple Silicon
I've long felt that the Apache Foundation is the internet's dumpster for open source software no one wants to maintain.
A word from Editor Moonshark about Artemis II - Ars Technica https://arstechnica.com/staff/2026/04/a-word-from-editor-moonshark-about-artemis-ii/
Everyone on the 14th floor knows what floor they’re really on. No one is fooled.
This was probably my favorite episode of #TheDaily I’ve listened to in a while. So human
https://overcast.fm/+ABLPtshQ1YQ
Troubleshooting location sharing in #Apple #FindMy for my in-laws. Any suggestions here? They’re set up as a family. We’ve toggled all the settings on/off: location services, FindMy, location sharing in Family, etc, on both devices
Location sharing *is* working the other direction, and works with other people
Just not outbound sharing with this specific person
RE: https://chaos.social/@icing/116345255280705894
Going back to the LKML post from earlier this week, for many projects, these tools are surfacing bugs much faster than human contributors can create bugs; so this should taper off for those projects
But also, you can count on token price rising substantially at some point as these companies try to become profitable. So at that point, I’d also expect a taper in bug reports
RE: https://hachyderm.io/@inthehands/116354584533790070
“We are the ones we’ve been waiting for.”
When I was in security engineering at Apple (2014-2018), the idea of a “wipe device” panic button or tripwire (there were lots of variations on the theme) came up from time to time.
Every time, we would soberly consider it and discuss it. Every time where we came down was: this is a good idea on paper, but having a “fuck the police” feature on your phone is an extremely white privileged concept. It is WAY WORSE for far more people than it is good for.
For a great many people, if they hand LE a wiped phone, their situation just got orders of magnitude more complicated. @corbet@social.kernel.org https://social.kernel.org/objects/4cdbec67-7b2c-46e9-95fc-ef455aa18f30
A couple of #OpenCode things to share...first is `opencode-docs`, that I adapted from the excellent `claude-code-docs`. It gives you a `/docs` command that makes OpenCode documentation available right in the opencode user interface
Replying to
Nope I was wrong. Sony 1994:
The term "GPU" was coined by Sony in reference to the 32-bit Sony GPU (designed by Toshiba) in the PlayStation video game console, released in 1994.
https://en.wikipedia.org/wiki/Graphics_processing_unit?wprov=sfti1#1990s
Replying to
Neoclouds like #CoreWeave are like the rug that the (US-specific[1]) AI industry, such as Nvidia, Microsoft, Meta, etc. are sweeping massive debt and risk under.
The circular financing is literally keeping that debt and risk off the hyperscalers’ books. It’s like money laundering, except it’s…debt/risk laundering? Idk
When this economic Jenga tower collapses, CoreWeave will be at the epicenter
[1] China is pursuing a totally different strategy and this is completely underreported in the US.
(cc @windsheep@infosec.exchange)
https://io-fund.com/ai-stocks/nvidia-coreweave-nebius-circular-financing-gpu-boom
